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REMARKS 

Claims 1-67 are pending in the present application. Applicants have amended 
Claims 1,10, 24, 26, 35, 47 and 56 herewith. Reconsideration of the claims is 
respectfully requested. 

I. 35 LLS.C. 8 112, Second Paragraph 

The Examiner rejected Claims 1 -67 under 35 U.S.C § 1 12, second paragraph, as 
being indefinite for failing to particularly point out and distinctly claim the subject matter 
which applicants regard as the invention. The Examiner states that the phrase "journaling 
the data to form journaled data" is indefinite and unclear, and also states that such phrase 
is being interpreted as "monitoring data" for purposes of examination. This rejection is 
respectfully traversed. 

With respect to Claim 1, 24, 26 and 47 ? Applicants have amended such 
independent claims to define what is meant by such objectionable phrase. 

Applicants traverse the rejection of Claims 2-12 for reasons given above with 
respect to Claim 1 (of which Claims 2-12 depend upon). 

Applicants traverse the rejection of Claims 27-37 for reasons given above with 
respect to Claim 26 (of which Claims 27-37 depend upon). 

Applicants traverse the rejection of Claims 48-58 for reasons given above with 
respect to Claim 47 (of which Claims 48-58 depend upon). 

With respect to Claims 13 (and dependent claims 14-21), 22 (and dependent 
Claim 23), 25, 38 (and dependent Claims 39-46) and 59 (and dependent Claims 60-67), 
Applicants urge that such claims do not tecite the phrase "journaling the data to fonn 
journal ed data", and thus to the extent this phrase is objectionable as being unclear, and 
all claims are being rejected based on such objectionable phrase being unclear, these 
Claims 13 (and dependent claims 14-21), 25, 38 (and dependent Claims 39-46) and 59 
(and dependent Claims 60-67) are shown to have been erroneously rejected under 35 
USC 112, 2 nd paragraph as they do not recite this objectionable phrase. 

Therefore the rejection of Claims 1-67 under 35 U.S.C. § 1 12, second paragraph 
has been overcome. 
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IL 35 U»S.C. 8 102. Anticipation 

The Examiner rejected Claims 1-67 under 35 U.S*C § 102(b) as being anticipated 
by Conklin et aL (US Patent No. 5,991,881) (hereinafter "Conklin"). This rejection is 
respectfully traversed. 

In response to the 35 USC 1 12 2 nd paragraph rejection, Applicants have amended 
Claim 1 to define that 'journaling of data' is different from •monitoring of data', since 
'monitoring of data' is being used by the Examiner as the interpretation of the claimed 
'journaling the data' in the examination of the presently claimed invention. Applicants 
urge that the cited reference does not teach any journaling of data, and thus does not 
teach the claimed steps of "determining whether a virus is present in the data processing 
system after journaling of the data has begun" or "responsive to an identification of the 
virus, restoring the data using the journaled data". Thus it is shown that Claim 1 is not 
anticipated by the cited reference, as every element of the claimed invention is not 
identically shown in a single reference. 

Applicants initially traverse the rejection of Claims 2-1 2 for similar reasons given 
above with respect to Claim 1. 

Further with respect to Claim 2, Applicants urge that the cited reference does not 
teach the claimed feature of "responsive to an absence of an identification of the virus, 
discarding the journaled data" as there is no teaching of any discarding of journaled data. 
Thus, Claim 2 is further shown to not be anticipated by the cited reference. 

Further with respect to Claim 8 7 Applicants urge that the cited reference does not 
teach the claimed feature of <4 responsive to an identification of the virus, blocking access 
to the data by a process accessing the data". Rather, the cited reference merely logs data 
and sends an alert message. Thus, Claim 8 is further shown to not be anticipated by the 
cited reference. 

Further with respect to Claim 9, Applicants urge that the cited reference does not 
teach the claimed feature of "responsive to an identification of the virus, generating an 
indication halting a process accessing the data". Rather, the cited reference merely logs 
data and sends an alert message. Thus, Claim 9 is further shown to not be anticipated by 
the cited reference. 
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Further with respect to Claim 10, Applicants urge that the cited reference does not 
teach the claimed feature of "wherein the journaled data is data accessed by a single 
process and maintained until a determination is made that the single process is eliminated 
as a vims candidate". Thus, Claim 10 is further shown to not be anticipated by the cited 
reference. 

Further with respect to Claim 1 1 (and dependent Claim 12), Applicants urge that 
the cited reference does not teach the claimed feature of "wherein the journaled data is 
stored in a protected memory accessible only by the method". Thus, Claim 1 1 (and 
dependent Claim 12) is further shown to not be anticipated by the cited reference. 

Still further with respect to Claim 12, Applicants urge that the cited reference 
does not teach the claimed feature of "wherein the journaled data is stored in a data 
structure located in a protected memory inaccessible by a process". Thus, Claim 12 is 
further shown to not be anticipated by the cited reference. 

With respect to Claim 13 (and dependent Claims 14-2 1, Applicants urge that the 
cited reference does not teach the claimed step of "saving a state of a data object in 
response to a request to access the data object by a process", which is in addition to the 
claimed step of "performing pattern matching of a set of actions taken within the data 
processing system". Applicants urge that the cited reference docs not teach, nor has the 
Examiner alleged any teaching of both pattern matching of a set of actions and saving a 
state of a data object in response to a request to access the data object by a process. 
Rather, the cited reference teaches that all activity is logged upon detection of an 
intrusion attempt. Thus, as every element of the claimed invention is not identically 
shown in a single reference, it is shown that Claim 13 (and dependent Claims 14-21) are 
not anticipated by the cited reference. 

Further with respect to Claim 15, Applicants urge that the cited reference does not 
teach the claimed feature of "if an intrusion is absent, determining whether a time 
threshold has been reached; and if an absence of a reaching of the time threshold is 
present, repeating the matching step using another set of actions". Thus, Claim 15 is 
further shown to not be anticipated by the cited reference. 

With respect to Claim 22 (and dependent Claim 23), it is urged that the cited 
reference does not teach the claimed feature of "a joumaler, wherein the joumaler 
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journals data in response to accessing of the data and restores the data to the prior state in 
response to the indication by the pattern matcher, wherein the data is journaled until the 
first indication is generated by the pattern matcher". As can be seen, this journaler (i) 
journals data in response to accessing of the data, and in addition this journaler (ii) 
restores the data to the prior state in response to the indication by the pattern matcher. 
The cited reference does not teach any such journaler that is responsive to both (i) 
accessing of the data and (ii) an indication by the pattern matcher. In addition, the cited 
reference does not teach any such journaler that restores the data to a prior state. Thus, as 
every element of the claimed invention is not identically shown in the cited reference, it 
is shown that Claim 22 (and dependent Claim 23) is not anticipated by the cited 
reference. 

Applicants traverse the rejection of Claim 24 for similar reasons to those given 
above with respect to Claim 1 . 

Applicants traverse the rejection of Claim 25 for similar reasons to those given 
above with respect to Claim 13* 

Applicants traverse the rejection of Claim 26 (and dependent Claims 27-37) for 
similar reasons to those given above with respect to Claim 1 . 

Applicants further traverse the rejection of Claim 27 for similar reasons to the 
further reasons given above with respect to Claim 2. 

Applicants further traverse the rejection of Claim 33 for similar reasons to the 
further reasons given above with respect to Claim 8. 

Applicants further traverse the rejection of Claim 34 for similar reasons to the 
further reasons given above with respect to Claim 9, 

Applicants further traverse the rejection of Claim 35 for similar reasons to the 
further reasons given above with respect to Claim 10. 

Applicants further traverse the rejection of Claim 36 (and dependent Claim 37) 
for similar reasons to the further reasons given above with respect to Claim 11. 

Applicants still further traverse the rejection of Claim 37 for similar reasons to the 
still further reasons given above with respect to Claim 12. 

Applicants traverse the rejection of Claim 38 (and dependent Claims 39-46) for 
similar reasons to those given above with respect to Claim 13. 
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Applicants further traverse the rejection of Claim 40 for similar reasons to those 
given above with respect to Claim 15. 

Applicants traverse the rejection of Claim 47 (and dependent Claims 48-58) for 
similar reasons to those given above with respect to Claim 1 . . 

Applicants further traverse the rejection of Claim 48 for similar reasons to the 
further reasons given above with respect to Claim 2, 

Applicants further traverse the rejection of Claim 54 for similar reasons to the 
further reasons given above with respect to Claim 8. 

Applicants further traverse the rejection of Claim 55 for isimilar reasons to the 
further reasons given above with respect to Claim 9. 

Applicants further traverse the rejection of Claim 56 for .similar reasons to the 
further reasons given above with respect to Claim 10. 

i 

Applicants further traverse the rejection of Claim 57 (and dependent Claim 58) 
for similar reasons to the further reasons given above with respect to Claim 1 1 . 

Applicants still further traverse the rejection of Claim 58 for similar reasons to the 
still further reasons given above with respect to Claim 12. 

Applicants traverse the rejection of Claim 59 (and dependent Claims 60-67) for 
similar reasons to those given above with respect to Claim 13. 

Applicants further traverse the rejection of Claim 61 for similar reasons to those 
given above with respect to Claim 1 5* 

Therefore, the rejection of Claims 1-67 under 35 U.S.C. l§ 102 has been 
overcome. 
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ID. Conclusion 

It is respectfully urged that the subject application i$ patentable over the cited 
reference and is now in condition for allowance. The Examiner is invited to call the 
undersigned at the below-listed telephone number if in the opinion of the Examiner such 
a telephone conference would expedite or aid the prosecution arid examination of this 
application. 



DATE: g»t f7ftftT 



Respectfully submitted, 

Duke W. Yee * 
Reg. No. 34,285 
Wayne P. Bailey : 
Reg. No. 34,289 : 
Yee & Associates, P.C. 
P.O. Box 802333 
Dallas, TX 75380 = 
(972) 385-8777 
Attorneys for Applicants 
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